Information about new TYPO3 releases as well as security bulletins are
being announced on the “TYPO3 Announce” mailing list. Every system
administrator who hosts one or more TYPO3 instances, and every TYPO3
integrator who is responsible for a TYPO3 project should subscribe to
this mailing list, as it contains important information. You can
subscribe at http://lists.typo3.org/cgi-
bin/mailman/listinfo/typo3-announce

This is a read-only mailing list, which means that you cannot reply to
a message or post your own messages. The announce list typically does
not distribute more than 3 or 4 mails per month. However it is highly
recommended to carefully read every message that arrives, because they
contain important information about TYPO3 releases and security
bulletins.

Other communication channels such as https://news.typo3.org/, a RSS feed,
an official Twitter account @typo3_security etc.
can be used additionally to stay up-to-date on security advisories.